CVE-2025-6609: Best Salon Management System SQLi Flaw

CVE-2025-6609 Overview

CVE-2025-6609 is a SQL injection vulnerability in SourceCodester Best Salon Management System 1.0. The flaw resides in /panel/bwdates-reports-details.php, where the fromdate and todate parameters are passed to backend SQL queries without proper sanitization. Authenticated attackers can manipulate these arguments to inject arbitrary SQL statements remotely. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic exploitation against exposed instances. The vulnerability is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers with low-privileged access can extract, modify, or delete records from the salon management database through crafted fromdate or todate parameter values.

Affected Products

Mayurik Best Salon Management System 1.0
SourceCodester Best Salon Management System 1.0
Component: /panel/bwdates-reports-details.php

Discovery Timeline

2025-06-25 - CVE-2025-6609 published to the National Vulnerability Database
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-6609

Vulnerability Analysis

The vulnerability exists in the date-range report generation feature of Best Salon Management System 1.0. The bwdates-reports-details.php script accepts fromdate and todate parameters from HTTP requests and concatenates them into SQL queries without parameterization or input validation. This allows attackers to break out of the intended query context and append arbitrary SQL clauses.

The injection point sits in a panel-facing administrative report, meaning the attacker needs low-privileged authenticated access to reach the vulnerable endpoint. Once reached, the attacker can read sensitive data from the database, including customer records, financial transactions, and credentials stored in the application schema.

The vulnerability falls under [CWE-74] for improper neutralization of special elements. Public proof-of-concept guidance is available through community vulnerability databases, lowering the technical barrier for exploitation.

Root Cause

The root cause is the direct concatenation of user-controlled HTTP parameters into SQL query strings. The application does not use prepared statements, parameterized queries, or input validation routines. Standard PHP/MySQL safe coding practices, such as mysqli_prepare() or PDO bound parameters, were not applied to the report generation flow.

Attack Vector

An authenticated attacker submits a crafted HTTP request to /panel/bwdates-reports-details.php with malicious SQL fragments embedded in the fromdate or todate parameters. The injected payload executes within the database context of the application user, returning result rows, time-based responses, or out-of-band signals depending on the payload type. The attack is network-reachable and requires no user interaction. Refer to the GitHub SQL Injection Guide for technical proof-of-concept details.

Detection Methods for CVE-2025-6609

Indicators of Compromise

HTTP requests to /panel/bwdates-reports-details.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences in the fromdate or todate parameters
Unexpected MySQL error messages in web server or PHP logs referencing the reports endpoint
Anomalous response times for report requests, indicating possible time-based blind SQL injection
Database queries returning unusual row counts or accessing tables outside the normal reporting scope

Detection Strategies

Deploy web application firewall rules to flag SQL keywords and tautologies in the fromdate and todate query parameters
Enable MySQL general query logging and alert on queries originating from the reports endpoint that reference unrelated tables
Correlate authentication logs with subsequent requests to /panel/bwdates-reports-details.php to identify low-privilege accounts probing the parameter

Monitoring Recommendations

Monitor outbound database connections from the web server for unexpected data volumes
Alert on HTTP 500 responses or database error strings returned from the panel directory
Track failed and successful authentications against the salon management panel for brute-force precursors to exploitation

How to Mitigate CVE-2025-6609

Immediate Actions Required

Restrict network access to the /panel/ directory using IP allow-listing or VPN-gated access until a patch is available
Audit existing application accounts and disable any unused or default credentials that could be used to reach the vulnerable endpoint
Review database logs for evidence of prior exploitation against the fromdate and todate parameters
Implement WAF signatures targeting SQL injection patterns on the reports endpoint

Patch Information

No official vendor patch has been published for Best Salon Management System 1.0 at the time of CVE publication. Operators should monitor SourceCodester and the VulDB advisory for updates. In the absence of a vendor fix, source code modifications to enforce parameterized queries in bwdates-reports-details.php are required.

Workarounds

Replace string concatenation with parameterized queries using mysqli_prepare() or PDO prepared statements in bwdates-reports-details.php
Apply server-side input validation to ensure fromdate and todate match a strict YYYY-MM-DD format before reaching SQL logic
Place the application behind a reverse proxy configured with SQL injection filtering rules
Limit the database account used by the application to read-only permissions on report-relevant tables

bash

# Example date format validation in PHP before query construction
$from = $_POST['fromdate'];
$to   = $_POST['todate'];

if (!preg_match('/^\d{4}-\d{2}-\d{2}$/', $from) ||
    !preg_match('/^\d{4}-\d{2}-\d{2}$/', $to)) {
    http_response_code(400);
    exit('Invalid date format');
}

$stmt = $conn->prepare(
    'SELECT * FROM reports WHERE date BETWEEN ? AND ?'
);
$stmt->bind_param('ss', $from, $to);
$stmt->execute();